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SUBJECT: RISK ADVISORY REGARDING INTERNAL CONTROLS OVER 
TRAVEL AND PER DIEM AND GAS CARD EXPENDITURES 



Recent incidents compel me to communicate directly with New Mexico state agencies 
regarding weaknesses in internal controls related to travel and per diem and gas card 
expenditures. The purpose of this risk advisory is to inform you of the risks pertaining to these 
types of expenditures and the related responsibilities of agency management and their 
independent public accountants (IPAs). The Office of the State Auditor (OS A) strongly 
encourages management and administrators of agencies to review their internal controls over 
travel and per diem and gas cards to ensure compliance with state law and regulations, and in 
order to reduce the risk of waste, fraud and abuse. Please review this advisory carefully. 

1) Travel and Per Diem Expenditures 

State agencies are required to use the Department of Finance and Administration's (DFA) 
standard form for processing travel and per diem reimbursement requests. Agency management 
should ensure that an employee's travel is independently reviewed and approved by an 
individual within the agency that has proper authority to approve the travel. Further, the Per 
Diem and Mileage Act (Sections 10-8-1 through 10-8-8 NMSA 1978) restricts the amount of 
reimbursement an employee may receive in any one year unless management approval is 
obtained. Specifically, Section 10-8-5(1) NMSA 1978 provides that an state employee may not 
be reimbursed more than $1,500, singly or in the aggregate, in any one year "until the person 
furnishes in writing to his department head or, in the case of a department head or board or 
commission member, to the governor or, in the case of a member of the legislature, to the New 
Mexico legislative council an itemized statement on each separate instance of travel covered 
within the reimbursement, the place to which traveled and the executive, judicial or legislative 
purpose served by the travel." Because DFA's standard form does not require a formal signature 
from a separate individual of the agency (such as a supervisor) as evidence that the employee's 
travel was reviewed and approved, agency management should ensure there is documentation 
evidencing approval of travel and per diem transactions. 
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The OSA has noted inconsistencies documented in per diem forms regarding employee 
vendor information and the employee's indicated post of duty or residence. For example, certain 
per diem forms for an employee contained a post of duty that did not coincide with the 
employee's vendor address, and the related travel was for the same location as the vendor 
address. Agencies should ensure vendor information is kept up to date and properly reflects an 
employee's post of duty or residence at the time the per diem is processed. Please note that 
employees who are subject to periodic reassignment of duty stations as a normal requirement of 
their employment are not eligible for per diem under 2.42.2.8(D) NMAC after the time of arrival 
at the new duty station. Per diem can be paid if the assignment is considered a nonroutine 
assignment according to 2.42.2.8(D) NMAC; however, such designation should adhere to 
2.42.2.8(D) NMAC and evidence should be available to support the determination. For instance, 
employees who are not normally subject to periodic reassignments who are temporarily assigned 
to another office of a state agency away from home may receive per diem for the first 30 
calendar days of their assignment only, unless approved by the Secretary of Finance and 
Administration. 

Additionally, a number of findings in recent state agency audit reports also reveal failures 
to comply with travel and per diem regulations, including: 1) incorrect payments that are either 
over or under the allowed per diem amount; 2) actual reimbursements for alcohol purchases; and 
3) failure to support actual payments with receipts. 

The guidance and related implemented internal controls (or lack thereof) over travel and 
per diem varies among agencies. Although 2.42.2.1 through 2.42.2.14 NMAC details travel and 
per diem regulations, the controls related to those requirements appear to vary depending on the 
size and complexity of the agency and the nature of an employee's duties. Each agency should 
design and implement internal controls to ensure all submitted travel and reimbursement requests 
comply with NMAC 2.42.2, are accurate, and constitute a reflection of actual events. 
Reimbursement requests not properly reviewed and approved in accordance with statute and 
regulation significantly increase the risk of fraudulent payment requests. 

2) Use of Gas Cards 

There have also been recent state agency audit report findings regarding the use of gas 
cards by state agencies. Controls over the use of these cards vary amongst agencies as well. 
There have been numerous instances of unallowed fuel type purchases; fuel and non-fuel 
purchases not supported by receipts; fuel purchases that exceed gas tank capacity; lack of a 
vehicle log supporting the travel related to the gas purchase; and other unsupported expenditures 
with gas cards. Some of the causes for the unallowed purchases appear to be the failure of 
agency management to communicate guidelines for the use of gas cards. In addition, there 
appears to be a lack of monitoring by agencies to ensure timely detection of any potential fraud, 
waste and abuse related to gas card use. 

Each agency should design and implement internal controls to ensure all gas card 
purchases are in compliance with state regulations, including 1.5.3.19, 1.5.3.20 and 1.5.4.12 
NMAC. Further, each agency should implement a monitoring process that is geared towards 
identifying potential unallowed purchases. 
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3) Guidance and Recommendations 

The OSA strongly encourages management and administrators of agencies to review their 
internal controls over travel and per diem and gas cards to ensure compliance with state 
regulations in order to reduce the risk of waste, fraud and abuse. Auditing standards provide that 
it is the responsibility of management to ensure that agencies have sound internal structure. 
Statement of Auditing Standards (SAS) Codification (AU) Section 110, paragraph .03, explains 
that it is management's responsibility to adopt sound accounting policies and to establish and 
maintain internal control that will, among other things, initiate, authorize, record, process, and 
report transactions (as well as events and conditions) consistent with management's assertions 
embodied in the financial statements. SAS AU 316 paragraph .04 states that "Management, 
along with those charged with governance, should set the proper tone; create and maintain a 
culture of honesty and high ethical standards; and establish appropriate controls to prevent, deter, 
and detect fraud. When management and those charged with governance fulfill those 
responsibilities, the opportunities to commit fraud can be reduced significantly." Furthermore, 
Statement on Auditing Standard (SAS) No. 112 paragraph 3 provides that "internal control is a 
process effected by those charged with governance, management, and other personnel, designed 
to provide reasonable assurance about the achievement of the entity's objectives with regard to 
reliability of financial reporting, effectiveness and efficiency of operations, and compliance with 
applicable laws and regulations." The OSA also reminds agencies and IPAs that pursuant to 
Section 12-6-6 NMSA 1978, an agency or IPA shall notify the State Auditor immediately, in 
writing, upon discovery of any violation of a criminal statute in connection with financial affairs. 
The notification shall include an estimate of the dollar amount involved, and a complete 
description of the violation, including names of persons involved and any action taken or 
planned. 

In relation to the test work required per 2.2.2.10(G)(2) NMAC, the IPA of each agency 
should evaluate the internal controls over travel and per diem and gas cards by reviewing and 
testing internal controls to ensure they are properly designed and implemented. Any violation of 
law or good accounting practice including instances of noncompliance or internal control 
weaknesses must be reported as an audit finding per Section 12-6-5 NMSA 1978. Pursuant to 
GAGAS 4.23, "auditors should communicate in the report on internal control over financial 
reporting and compliance, based upon the work performed: significant deficiencies and material 
weaknesses in internal control; instances of fraud and noncompliance with provisions of laws or 
regulations that have a material effect on the audit and any other instances that warrant the 
attention of those charged with governance; noncompliance with provisions of contracts or grant 
agreements that has a material effect on the audit; and abuse that has a material effect on the 
audit." 

For additional information regarding internal control structure questions, state agencies 
should consult the DFA, the OSA or your agency's IPA. Please contact the OSA should you 
have questions about this risk advisory. 



